It's refreshing to see this acknowledgment: "the current "patch and pray" system won't cut it in the future" It's also admirable that rules and regulations hav

It's refreshing to see this acknowledgment: "the current "patch and pray" system won't cut it in the future" It's also admirable that rules and regulations have been outlined to achieve a 'meaningful' handle on cybersecurity. However, policy makers are just that - policy makers - and the rules and regulations outlined are just "bureaucratic" layers and incarnations of security patches. They have accepted the inevitable (note, the article/study does not mention R&D directives/initiatives to improve cyberintelligence gathering) and have 'padded' themselves with rules to project a perception of action to improve their stance on this front. Frankly, putting it on paper in the hopes that it will work doesn't necessarily mean it will work.